Controls library.

1,423 controls across 4 frameworks

Comparing to global GRC platforms? See Control Stack vs Drata, Vanta and Scytale.

Working through ISO 27001? Use the free ISO 27001 Annex A checklist, no account needed.

ISO 27001:202293ISO 42001:202338Essential Eight149Information Security Manual (ISM)1143

Annex A 10.2 · ISO 42001Allocating Responsibilities
Decide and write down which party (your organisation, your partners, suppliers, customers or other third parties) is responsible for each task across the life of an AI system, so no duty is left unowned.
Annex A 10.3 · ISO 42001Manage Suppliers to Support Responsible AI Use
Set up a process so that the services, products and materials you buy from suppliers support the responsible development and use of your AI (artificial intelligence) systems.
Annex A 10.4 · ISO 42001Consider Customer Expectations and Needs When Using AI
Make sure your responsible approach to building and using artificial intelligence (AI) takes account of what your customers expect and need.
Annex A 2.2 · ISO 42001AI Policy
The organisation writes down an approved policy that sets the rules for how it builds and uses AI systems, and states which AI activities the policy covers.
Annex A 2.3 · ISO 42001Alignment with Other Organisational Policies
Work out which of your existing organisational policies are affected by, or already apply to, your goals for AI systems, then amend or cross-reference them so the two do not contradict each other.
Annex A 2.4 · ISO 42001Review the AI Policy at Planned Intervals to Keep It Effective
Your organisation regularly reviews its artificial intelligence (AI) policy, and reviews it again whenever circumstances change, to confirm it remains suitable, adequate and effective.
Annex A 3.2 · ISO 42001Define and Allocate AI Roles and Responsibilities
Your organisation must clearly decide who is responsible for each part of managing artificial intelligence and formally assign those responsibilities to named people.
Annex A 3.3 · ISO 42001Process for Reporting Concerns About AI Systems
Set up a clear, accessible way for people to raise concerns about your organisation's role in any AI (artificial intelligence) system at any stage of its life.
Annex A 4.2 · ISO 42001Resource Documentation
The organisation identifies and documents the resources needed for each stage of an AI system's life cycle and for any other AI-related work it carries out. Resources include data, computing power, tooling, and the skilled people who build and run the system.
Annex A 4.3 · ISO 42001Document the Data Resources Used by Your AI System
Your organisation must keep a written record of the data resources used by each artificial intelligence (AI) system.
Annex A 4.4 · ISO 42001Document the Tooling Resources Used for AI Systems
Your organisation must keep written records of the tools used to build, run and support each AI (artificial intelligence) system, as part of identifying the resources your AI management system (AIMS) depends on.
Annex A 4.5 · ISO 42001Document System and Computing Resources Used by AI Systems
Your organisation keeps a written record of the system and computing resources used to run each artificial intelligence (AI) system.
Annex A 4.6 · ISO 42001Document the People and Skills Running Your AI System
The organisation must record who works on its AI system across its whole life and the competences they bring.
Annex A 5.1 · ISO 27001Policies for information security
Have clear, approved security policies that everyone knows about and follows.
Annex A 5.10 · ISO 27001Acceptable Use Policies for Information and Assets
Create and communicate rules for how information and assets should be used to ensure security.
Annex A 5.11 · ISO 27001Return of Organisation's Assets upon Departure
Ensure that employees and external parties return all company assets when their job or contract ends.
Annex A 5.12 · ISO 27001Information Classification Policy and Practices
Classify data based on security needs so everyone handles it correctly.
Annex A 5.13 · ISO 27001Labelling of Information
Create and use clear labels to show how sensitive information is, so it is correctly handled.
Annex A 5.14 · ISO 27001Information Transfer Policies and Procedures
Ensure secure and controlled transfer of information within and outside the organisation.
Annex A 5.15 · ISO 27001Access Control Policies and Procedures
Set and apply rules for who can access information and systems based on their security needs.

Controls library.

Annex A 10.2 · ISO 42001Allocating Responsibilities

Annex A 10.3 · ISO 42001Manage Suppliers to Support Responsible AI Use

Annex A 10.4 · ISO 42001Consider Customer Expectations and Needs When Using AI

Annex A 2.2 · ISO 42001AI Policy

Annex A 2.3 · ISO 42001Alignment with Other Organisational Policies

Annex A 2.4 · ISO 42001Review the AI Policy at Planned Intervals to Keep It Effective

Annex A 3.2 · ISO 42001Define and Allocate AI Roles and Responsibilities

Annex A 3.3 · ISO 42001Process for Reporting Concerns About AI Systems

Annex A 4.2 · ISO 42001Resource Documentation

Annex A 4.3 · ISO 42001Document the Data Resources Used by Your AI System

Annex A 4.4 · ISO 42001Document the Tooling Resources Used for AI Systems

Annex A 4.5 · ISO 42001Document System and Computing Resources Used by AI Systems

Annex A 4.6 · ISO 42001Document the People and Skills Running Your AI System

Annex A 5.1 · ISO 27001Policies for information security

Annex A 5.10 · ISO 27001Acceptable Use Policies for Information and Assets

Annex A 5.11 · ISO 27001Return of Organisation's Assets upon Departure

Annex A 5.12 · ISO 27001Information Classification Policy and Practices

Annex A 5.13 · ISO 27001Labelling of Information

Annex A 5.14 · ISO 27001Information Transfer Policies and Procedures

Annex A 5.15 · ISO 27001Access Control Policies and Procedures

Filters

Control effect (Control Stack)

Domain (ISO 27001)

Annex A theme (ISO 42001)

Strategy (Essential 8)

Maturity level

Classification (ISM)

Control Stack topics

ISM Guideline

ISM Section

Control status

New task